Cryptography and data protection
Cryptography and data protection tests whether you can choose the right primitive and protect keys, not just name algorithms. Expect scenarios about data in transit, at rest, and in use, plus password storage, digital signatures, and tokenization.
Core rules and concepts
- Symmetric encryption uses one shared key and is fast for bulk data, such as AES. Asymmetric encryption uses a public and private key pair for key exchange and signatures but is slower.
- Hashing is one-way and supports integrity checks; it is not encryption. A salted, slow password hash such as Argon2, bcrypt, or PBKDF2 resists cracking better than a fast hash.
- HMAC combines a hash with a shared secret for message integrity and authenticity. A digital signature uses a private key and provides integrity, authenticity, and non-repudiation.
- PKI binds identities to public keys through certificates and a chain of trust. TLS protects data in transit; it does not protect data at rest.
- Key management covers generation, storage, rotation, separation, and destruction. Envelope encryption wraps data keys with a key-encryption key managed in a KMS or HSM.
Worked example
A team stores customer records in a cloud database and card data in one column. Use TLS for connections, enable storage encryption with customer-managed keys, and tokenize the card number so the database never holds the primary account number. Restrict key use with IAM and log key operations. For user passwords, store an Argon2id hash with a unique salt, never encrypted passwords or unsalted SHA-256.
Traps that cost marks
Encoding and obfuscation are not encryption. Hashing cannot be reversed, so it is unsuitable for data you must recover. Signing does not confidentiality-protect a message. TLS alone does not satisfy an at-rest encryption requirement.